kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-7308.json"
[
{
"digest": {
"function_hash": "326914359773850603727218387353975106796",
"length": 398.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "states_equal"
},
"signature_type": "Function",
"id": "CVE-2019-7308-0bec9a8b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "207132037205159845546600269465900161234",
"length": 585.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "copy_verifier_state"
},
"signature_type": "Function",
"id": "CVE-2019-7308-32fd857c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "48320516282864774449412741221432115794",
"length": 4786.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
},
"signature_type": "Function",
"id": "CVE-2019-7308-3e2effde",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "22783977611527452721980536284539711149",
"length": 675.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "push_stack"
},
"signature_type": "Function",
"id": "CVE-2019-7308-42958bd2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "150323760660487400918659421900339384955",
"length": 7103.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "do_check"
},
"signature_type": "Function",
"id": "CVE-2019-7308-7fdd4786",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"107788994864617693643116693061103278818",
"106079743749843658021775344583427673639",
"320056761904361972254150238651215357173",
"185251871769341407918661518003882638808",
"281616918271498594775461730225318556537",
"119873869793026019372536885601341482092",
"186225144672612769480755754270965405891",
"25787974841327820412066241968807610616",
"330292516189863160654122324387809592175",
"243305606780518168405130618389823431951",
"259710687685064325266796827861102766985",
"5073486612961382460078789198789405385",
"220082853007074704731493766471270654569",
"60441847071174790201090129864348191714",
"185172262500521423252892484952555991658",
"7974767188581210091429568198955116853"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "include/linux/bpf_verifier.h"
},
"signature_type": "Line",
"id": "CVE-2019-7308-a3e57871",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "238227538297470067740665865299362246121",
"length": 5557.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "fixup_bpf_calls"
},
"signature_type": "Function",
"id": "CVE-2019-7308-a6fa5c41",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "301707568031422756190382032380213335045",
"length": 2559.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "check_cond_jmp_op"
},
"signature_type": "Function",
"id": "CVE-2019-7308-b5b99af9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"233972072443480794669413701921747231123",
"210412820069574192567502928312410442308",
"153586803533435701155387123507508063456",
"172472896814887932147642298473406015781",
"210388012350243519061927010783788666104",
"93941573976886281001822976692280581709",
"161798387430693281109673893283559582623",
"292071806086889041743033529991411232428",
"95407147661306156765164622648193148363",
"91458703002078555569665583132857704328",
"56982378154407349886468818198958166616",
"124761676110909749141012982011443447411",
"71197851345749087879636811572101389340",
"62152912016735987520842711098881689640",
"24098686306953093500402656621660559655",
"277248056179856428323883280196159250863",
"42043573543902112902324416114194551565",
"175028192776914521355342385516753927099",
"17267565850789597100520824007761348139",
"334481237432396224568320706289715556744",
"30551162904059944522018493058304011040",
"37383073498024145242900673179419810154",
"47126033843358546450203082796503968490",
"337295974858193987875810377818283856662",
"128568435286444294847919577374895015729",
"179491001885278729852462731721214234854",
"17521781370613500689025784994915140149",
"266437121029169494543554584552284073065",
"256304688429828306114493548251460119971",
"264987866140641804145924617647579534899",
"190204303695318516779202191744371303346",
"48682839317715203045415110214740832823",
"234615906544745890803880612167113151495",
"108932752539789910245154293690930511839",
"9037582549771184385560564377018713062",
"28186688528659160243430203399394958178",
"245949317736060633266662368777338593080",
"39810691766798390733888432440189548798",
"51091596540513940106443464448241888869",
"264091811196358443535915692384818742388",
"287163264390290752825654852600304968421",
"231285215998516245580484558391774793239",
"205477771792063964587565536001733577867",
"10539704184795120264365648241249310763",
"177246050552663199463381310417738756536",
"221512589023063790881416899638109698899",
"250210401306231593065711664481591068975",
"99985389255534418773987930999517141597",
"44485585305464604756131009392587745822",
"155673186534514980530292449546216434837",
"202178381897683235380151513486067266273"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"id": "CVE-2019-7308-da2fd1d7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-7308.json"
[
{
"digest": {
"function_hash": "326914359773850603727218387353975106796",
"length": 398.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "states_equal"
},
"signature_type": "Function",
"id": "CVE-2019-7308-50627255",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"107788994864617693643116693061103278818",
"106079743749843658021775344583427673639",
"320056761904361972254150238651215357173",
"185251871769341407918661518003882638808",
"281616918271498594775461730225318556537",
"119873869793026019372536885601341482092",
"186225144672612769480755754270965405891",
"25787974841327820412066241968807610616",
"330292516189863160654122324387809592175",
"243305606780518168405130618389823431951",
"259710687685064325266796827861102766985",
"5073486612961382460078789198789405385",
"220082853007074704731493766471270654569",
"60441847071174790201090129864348191714",
"185172262500521423252892484952555991658",
"7974767188581210091429568198955116853"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "include/linux/bpf_verifier.h"
},
"signature_type": "Line",
"id": "CVE-2019-7308-5c264d21",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "22783977611527452721980536284539711149",
"length": 675.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "push_stack"
},
"signature_type": "Function",
"id": "CVE-2019-7308-7e53c00d",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "207132037205159845546600269465900161234",
"length": 585.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "copy_verifier_state"
},
"signature_type": "Function",
"id": "CVE-2019-7308-83f6eb5c",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "150323760660487400918659421900339384955",
"length": 7103.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "do_check"
},
"signature_type": "Function",
"id": "CVE-2019-7308-9d8c3d66",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "301707568031422756190382032380213335045",
"length": 2559.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "check_cond_jmp_op"
},
"signature_type": "Function",
"id": "CVE-2019-7308-d8186b1e",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "238227538297470067740665865299362246121",
"length": 5557.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "fixup_bpf_calls"
},
"signature_type": "Function",
"id": "CVE-2019-7308-efc88d52",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"233972072443480794669413701921747231123",
"210412820069574192567502928312410442308",
"153586803533435701155387123507508063456",
"172472896814887932147642298473406015781",
"210388012350243519061927010783788666104",
"93941573976886281001822976692280581709",
"161798387430693281109673893283559582623",
"292071806086889041743033529991411232428",
"95407147661306156765164622648193148363",
"91458703002078555569665583132857704328",
"56982378154407349886468818198958166616",
"124761676110909749141012982011443447411",
"71197851345749087879636811572101389340",
"62152912016735987520842711098881689640",
"24098686306953093500402656621660559655",
"277248056179856428323883280196159250863",
"42043573543902112902324416114194551565",
"175028192776914521355342385516753927099",
"17267565850789597100520824007761348139",
"334481237432396224568320706289715556744",
"30551162904059944522018493058304011040",
"37383073498024145242900673179419810154",
"47126033843358546450203082796503968490",
"337295974858193987875810377818283856662",
"128568435286444294847919577374895015729",
"179491001885278729852462731721214234854",
"17521781370613500689025784994915140149",
"266437121029169494543554584552284073065",
"256304688429828306114493548251460119971",
"264987866140641804145924617647579534899",
"190204303695318516779202191744371303346",
"48682839317715203045415110214740832823",
"234615906544745890803880612167113151495",
"108932752539789910245154293690930511839",
"9037582549771184385560564377018713062",
"28186688528659160243430203399394958178",
"245949317736060633266662368777338593080",
"39810691766798390733888432440189548798",
"51091596540513940106443464448241888869",
"264091811196358443535915692384818742388",
"287163264390290752825654852600304968421",
"231285215998516245580484558391774793239",
"205477771792063964587565536001733577867",
"10539704184795120264365648241249310763",
"177246050552663199463381310417738756536",
"221512589023063790881416899638109698899",
"250210401306231593065711664481591068975",
"99985389255534418773987930999517141597",
"44485585305464604756131009392587745822",
"155673186534514980530292449546216434837",
"202178381897683235380151513486067266273"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"id": "CVE-2019-7308-f8cc1946",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
},
{
"digest": {
"function_hash": "48320516282864774449412741221432115794",
"length": 4786.0
},
"signature_version": "v1",
"target": {
"file": "kernel/bpf/verifier.c",
"function": "adjust_ptr_min_max_vals"
},
"signature_type": "Function",
"id": "CVE-2019-7308-fbca9339",
"source": "https://github.com/torvalds/linux/commit/979d63d50c0c0f7bc537bf821e056cc9fe5abd38",
"deprecated": false
}
]